Hello and welcome to the Wednesday, May 28, 2025 edition of the Sands International Center's StormCast.

My name is Johannes Ulrich, and this episode brought to you by the Sands EDU

bachelor's degree program in Applied Cybersecurity is recorded in Jacksonville, Florida.

Well, today we have a quick diary, nothing really too exciting and special, but it's really

about the security of SSH servers, in particular the authorized keys file. Now, we all know

that we should use keys for authentication, not passwords, but the number one thing that I sort of see all these bots doing is that after the preach a Unix system, they will add a key of their choosing to the authorized keys file, giving them essentially a backdoor into the

system. So securing the file certainly sounds like a good idea, in particular on some of these

IoT and smaller Unix systems. I think the number one lesson here is that if you want to manage these keys centrally,

you don't have to put them into the user's home directory.

There is a simple configuration with SSH, at least with OpenSH that pretty much everybody is using,

that allows you to store all the key files for all the users into a special directory.

You basically just use the username or the numeric user ID as the name of the file for each user.

And that way you have a centrally managed access.

The files only need to be readable by the users.

They don't need to be writable the users. They don't need to be

writable by users. So that way, an attacker should no longer be able to modify these files

at well, at least not all of these bots and such that we see performing this particular

technique. And of course, that also makes them monitoring these files a lot simpler

to detect any changes, in particular unauthorized changes, of course, early.

Also, talking about IoT vulnerabilities,

there is a good example here that I saw in a blog post from One Key. One Key makes software to find security

vulnerabilities. So one of those software scanning softwares. And they took a look at Meteorbridge.

...